Get Your Insecure PostgreSQL Passwords to SCRAM!
summary
Shows why PostgreSQL passwords must move to SCRAM and demonstrates the actual upgrade steps and failures avoided: building a SCRAM verifier with a 16 byte salt, using PBKDF2 and 4096 iterations, creating stored and server keys, exchanging client proof and server signature so secrets never travel, and adding TLS channel binding. Notes PostgreSQL 10/11/13/14 behavior, driver and libpq support, proxy (PgBouncer) implications, and that an on-the-spot upgrade to SCRAM-SHA-256 succeeds.
AI-written summary · about
chapters (28)
- 0:00Intro
- 0:34aka "A Tale of Two Hippos"
- 0:45Guest Starring Blue Elephant
- 3:10How Do Passwords Work in PostgreSQL?
- 4:34PostgreSQL Plaintext Passwords
- 5:35Plaintext Password Authentication Flow
- 6:41Transport Layer Security
- 9:08PostgreSQL MD5 Password Authentication
- 9:53MD5 Authentication Flow
- 14:33Salted Challenge Response Authentication Mechanism
- 17:14Creating a Password For SCRAM
- 18:05Building a SCRAM Secret - DIGEST
- 18:34Building a SCRAM Secret - ITERATIONS
- 19:55Building a SCRAM Secret - SASLPrep the Password
- 20:48Building a SCRAM Secret - Generate the Salted Password
- 22:59Building a SCRAM Secret - SERVER KEY
- 23:25Building a SCRAM Secret - "Easy Button"
- 28:39SCRAM Authentication Flow: Generating Proof
- 29:28Recall: Client Key
- 30:59Client Signature
- 32:20SCRAM Authentication Flow: Server Verification
- 34:34Server Signature
- 35:23SCRAM Authentication Flow: Client Verification
- 37:09Case #1: Server "Claims" To Know Secret
- 38:01Case #2: Elephant-in-the-Middle Attack
- 38:58Channel Binding
- 41:57Upgrading to SCRAM
- 43:17Driver Support for SCRAM
related talks
46mGet Your Insecure PostgreSQL Passwords to SCRAM!
05mRoad to Percona Live 2022 - Jonathan Katz
54mConfiguration and Authentication
32mEnhancing Security in PostgreSQL
32mPostgreSQL Security: Defending Against External Attacks
35mSecuring PostgreSQL From External Attack
50mSecuring PostgreSQL
48mAdvanced Authentication and Encrypted Connections